firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add support for VPN out (client).

Browse Source
This commit is contained in:
Christoph
2018-09-23 00:33:26 +02:00
parent 994cfcefa9
commit 9e7a82e408
2 changed files with 116 additions and 264 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
ip6t-firewall-server
View File

@ -12,10 +12,6 @@
CONFIG_FILE=/etc/ipt-firewall/ip6t-firewall-server.conf
if [[ -z "$fail2ban_client" ]]; then
fail2ban_client="$(which fail2ban-client)"
fi
# ------------- Load Kernel Modules -------------
#
@ -102,9 +98,9 @@ fi # if ! $host_is_vm
# ------------- Stop Fail2Ban if installed -------------
#
if [ -x "$fail2ban_client" ]; then
if [ -x "$fail2ban_init_script" ]; then
echononl "\tStopping fail2ban.."
$fail2ban_client stop > /dev/null 2>&1
$fail2ban_init_script stop > /dev/null 2>&1
if [ "$?" = "0" ];then
echo_done
else
@ -531,39 +527,20 @@ fi
echo_done
# ---
# - VPN
# ---
# ---
# - Permit all traffic through VPN lines
# ---
echononl "\tPermit all traffic through VPN lines.."
if [[ ${#vpn_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_vpn_server_ip_arr[@]} -gt 0 ]] ; then
if [[ ${#vpn_server_ip_arr[@]} -gt 0 ]] ; then
for _ip in ${vpn_server_ip_arr[@]} ; do
for _port in ${vpn_port_arr[@]} ; do
$ip6t -A INPUT -p udp -d $_ip --dport $_port -m state --state NEW -j ACCEPT
done
done
for _vpn_if in ${vpn_if_arr[@]} ; do
$ip6t -A INPUT -i $_vpn_if -j ACCEPT
$ip6t -A OUTPUT -o $_vpn_if -j ACCEPT
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -i $_vpn_if -j ACCEPT
$ip6t -A FORWARD -o $_vpn_if -j ACCEPT
fi
done
for _vpn_if in ${vpn_if_arr[@]} ; do
$ip6t -A INPUT -i $_vpn_if -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A OUTPUT -o $_vpn_if -m conntrack --ctstate NEW -j ACCEPT
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -i $_vpn_if -j ACCEPT
$ip6t -A FORWARD -o $_vpn_if -j ACCEPT
fi
if [[ ${#forward_vpn_server_ip_arr[@]} -gt 0 ]] && $kernel_forward_between_interfaces ; then
for _ip in ${forward_vpn_server_ip_arr[@]} ; do
$ip6t -A FORWARD -p udp -d $_ip --dport $_port -m state --state NEW -j ACCEPT
done
fi
echo_done
else
echo_skipped
fi
done
echo_done
echo
@ -779,6 +756,46 @@ else
fi
# ---
# - VPN
# ---
echononl "\t\tVPN Service only out"
if [[ ${#vpn_port_arr[@]} -gt 0 ]] ; then
for _dev in ${ext_if_arr[@]} ; do
for _port in ${vpn_port_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p udp --dport $_port -m state --state NEW -j ACCEPT
done
done
echo_done
else
echo_skipped
fi
echononl "\t\tVPN Services.."
if [[ ${#vpn_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_vpn_server_ip_arr[@]} -gt 0 ]] ; then
if [[ ${#vpn_server_ip_arr[@]} -gt 0 ]] ; then
for _ip in ${vpn_server_ip_arr[@]} ; do
for _port in ${vpn_port_arr[@]} ; do
$ip6t -A INPUT -p udp -d $_ip --dport $_port -m state --state NEW -j ACCEPT
done
done
fi
if [[ ${#forward_vpn_server_ip_arr[@]} -gt 0 ]] && $kernel_forward_between_interfaces ; then
for _ip in ${forward_vpn_server_ip_arr[@]} ; do
$ip6t -A FORWARD -p udp -d $_ip --dport $_port -m state --state NEW -j ACCEPT
done
fi
echo_done
else
echo_skipped
fi
# ---
# - Rsync Out
# ---
@ -1213,7 +1230,7 @@ echononl "\t\tSpecial TCP Ports OUT"
if [[ ${#tcp_out_port_arr[@]} -gt 0 ]] || [[ ${#forward_tcp_out_port_arr[@]} -gt 0 ]] ; then
if [[ ${#tcp_out_port_arr[@]} -gt 0 ]] ; then
if [[ ${#forward_tcp_out_port_arr[@]} -gt 0 ]] ; then
for _dev in ${ext_if_arr[@]} ; do
for _port in ${tcp_out_port_arr[@]} ; do
@ -1364,10 +1381,10 @@ echo_done
# ------------- Start Fail2Ban if installed
# -------------
if [ -x "$fail2ban_client" ]; then
if [ -x "$fail2ban_init_script" ]; then
echo
echononl "\tStarting fail2ban.."
$fail2ban_client start > /dev/null 2>&1
$fail2ban_init_script start > /dev/null 2>&1
if [ "$?" = "0" ];then
echo_done
else